Four reviews. kings-guard found that v0.6 claimed a human/agent principal
separation in §1 and §15 while §3.4 was byte-identical to v0.5: a silent edit
failure, and their framing is the right one — a rule stated about a standard in
its own change log is not a rule, which is §11's principle turned on the
standard. The same failure had dropped two §16 entries. Both restored.
§3.4 is now written: no standing credential, conduit or engine API only, agent
memory is not a state plane, every action reconstructable as the caller's, and
the seam with glas-harness for session semantics.
The rest are collisions between rules each written for its own clean case:
- §6.4(1) forbade what §6.4(3) blesses. A PEP may proceed under its declared
§9.3 stance where the application of that stance is recorded in place of the
decision — stricter than v0.6, since a fail-open result becomes metadata
rather than silence. Raised by ops-warden, the reference shape it made a
violation.
- §6.4(2) forbade the session-bound allow §9.7.1 permits. Now scoped to replay
outside the decision's own binding and lifetime, with access-engine's
canonical request digest as the mechanical test. Negative caching ruled
permitted where the refusal is recorded and the lifetime declared.
- §13.1 now exists: v0.6 mandated a stance-map register and implemented none.
Its first inventory has one row, which is the finding.
- §9.6 gained a threat decomposition after audit-core corrected its own remedy:
atomicity prevents accidental omission, cadence and reconciliation detect the
adversarial case, nothing prevents it at a compromised source. Cadence is now
MUST for load-bearing sources, with heartbeat or reconciliation required for
low-volume classes where rate monitoring cannot work.
- §9.7.2 splits by role: per input class at a PDP, one boundary deadline at a
PEP.
- §17 moves the decision-record schema to access-engine, which argued it against
its own interest.
- §13 stops attributing the actuation gap to kings-guard; §19 removed, since a
verdict inside a standard grades the document it lives in.
§20 records the Railiance interaction boundary on railiance-master's own
definitions: the four axes, that a workload is a managed running deployable so
approvals are never one, and that rein-* is not a fifth axis but a glas-harness
concern. What is unsettled is listed as unsettled.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
From the independent assessment of 2026-08-29, which found the model sound as a
layering constitution and incomplete as a self-healing one: cognition,
authority, and execution are specified, but the two verbs that close a healing
loop — observe in production, actuate through a deterministic surface — are
pending, and one is unstaffed.
Section numbers below §14 are unchanged; the estate cites them.
- §3.3 types the Engine layer: PDP, PIP, Evidence, Lifecycle, with a role column
in §4. Collapsing them hid different failure modes — a PIP outage is input
degradation, a PDP outage is consumer residue, an evidence-plane outage must
not block the operation it records. A new engine is a PIP unless amended.
- §6.4 names the enforcement point. The standard was precise about the decision
and silent about the gate, so enforcement lived in Staff runbooks. Four
obligations: no side effect without a decision record, no local recaching of
the verdict, a declared unreachable-engine stance, reconstructability.
- §9.2 replaced. Containment was marked pending against kings-guard, the right
mark on the wrong repository: reduce, step-up, and isolate are
authority-changing operations, so they are rendered by an Engine and enforced
by a PEP. Actuation is an unowned Engine concept held at zero. Staff proposes
containment and never performs it.
- §3.4 separates human and agent principals inside Staff — same permissions,
different blast radius. No standing credential, conduit or engine API only,
agent memory is not a state plane, every action reconstructable as the
caller's.
- §9.7 puts time into the model: explicit lifetimes, revocation visibility
deadlines, consumption as a state change never inferred from a decision
record, and the three race modes named. §9.8 states what holds under
partition.
- §17 requires the Taxonomy artifacts — claim, decision-record, gap-record, and
emission-cadence schemas — without which §6.2 and §11 are reviewable but not
compileable. Ownership proposed, not assigned.
- §18 composes the sibling standards, which had been cited in frontmatter and
nowhere in the rules.
- §5 sunsets the uncatalogued-infrastructure carve-out. §5.3 declines a proposed
fourth "operator of third-party Tooling" shape: it would convert a tracked gap
into a permanent allowance, which is the relabelling failure this standard
exists to prevent.
- §10 gains the six artifacts a layer change must carry, written from the
zone-engine case, including a permission freeze during the cut.
- §2 lifts the observation rule so it cannot be lost in a summary. §13 separates
its three normative rules from the table, now a snapshot due to move into
maturity-engine. §16 decides the approval custody question: no. §19 records
the fitness verdict.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
